IAM

Question 1

What does IAM stand for?

Answer 1

Identity Access Management

Question 2

What is the role of IAM?

Answer 2

To control who is authenticated (signed in) and authorised (has permissions) to use resources

Question 3

What is an IAM user?

Answer 3

End users: people, employees, etc

Question 4

What is an IAM group?

Answer 4

A collection of users

Question 5

What are IAM policies?

Answer 5

A collection of documents in JSON format

Question 6

What is the role of IAM policies?

Answer 6

To give permissions to what each user/group/role is able to do

Question 7

What is the role of an IAM group?

Answer 7

To set permissions for users within the group to inherit

Question 8

What are the features of IAM? (10)

Answer 8

1. Centralised control
2. Shared access
3. Granular permissions
4. Identity federation
5. Multi-factor authentication
6. Temporary access
7. Customisable password rotation policy
8. AWS service integration
9. PCI DSS compliance (credit card details)
10. Eventually consistent

Question 9

What is the benefit of shared access in IAM?

Answer 9

Other people can gain permission to administer or use resources in your AWS account without having to share your password or access key

Question 10

What are the properties of your initial sign-in identity under IAM? (3)

Answer 10

• You begin with a single sign-in identity
• This identity is called the root user
• The root user has complete access to all AWS services and resources in the account

Question 11

What are the properties of newly created users? (2)

Answer 11

• Have no permissions

- Are assigned an access key ID and secret access keys

Question 12

What are access key ID and secret access keys used for? (2)

Answer 12

• To access AWS via APIs and the command line

- Cannot be used to log into the console

Question 13

What happens if you lose your access key IDs and secret access keys? (2)

Answer 13

• Must regenerate them

- You can only view your access key IDs and secret access keys once

Question 14

What is the benefit of identity federation in IAM? (2)

Answer 14

• Allows users who already have passwords elsewhere to get temporary access to your AWS account
• Does not create an IAM user

Question 15

What is the benefit of multi-factor authentication in IAM?

Answer 15

Requires users to prove physical possession of a hardware MFA token or MFA-enabled mobile device by providing a valid MFA code

Question 16

What are IAM permission conditions?

Answer 16

Conditions which must be present for the policy to take effect

Question 17

Give four examples of IAM permission conditions (4)

Answer 17

• Time of day
• SSL
• MFA authentication
• IP address